Forensic Dissection: The Binary Media Conveyor 'Strana.ua -> Russian Z-Channels -> TASS' During Localized Power Outages in Kyiv (04.11.2026) and the 'Video Refrigerator' of the 85th Main Special Service Center of the GRU (@rezident_ua / @spletnicca)

FORENSIC DISSECTION: THE BINARY MEDIA CONVEYOR 'STRANA.UA -> RUSSIAN Z-CHANNELS -> TASS' DURING LOCALIZED POWER OUTAGES IN KYIV (04.11.2026) AND THE 'VIDEO REFRIGERATOR' OF THE 85TH MAIN SPECIAL SERVICE CENTER OF THE GRU

Publication Date: 05.11.2026

Investigation ID: ISSUE-2026-11-05-STRANA-TASS-GRU-CONVEYOR

Category: COUNTERINTELLIGENCE & MTPROTO FORENSICS · RUSSIAN MEDIA BRIDGES & BDA FEEDBACK LOOP

Legal Qualification of Threats: Art. 111 CCU (High Treason / Informational Assistance to the Aggressor), Art. 114-1 CCU (Obstruction of Lawful Activities of the AFU), Art. 279 CCU (Blocking of Transport Communications)

EXECUTIVE FORENSIC SUMMARY

Direct tracing of binary Telegram media identifiers (MTProto document.id) and video container metadata (ISO-BMFF / ffprobe creation_time) across November 4-5, 2026 documented two interconnected contours of Russian psychological and information operations targeting Ukraine's rear:

• The 58-Minute Binary Bridge 'Strana.ua -> @RVvoenkor -> TASS' During Localized Power Line Faults in Kyiv (04.11.2026): On the evening of November 4, 2026, on Akademika Palladina Avenue (between the Zhytomyrska and Akademmistechko metro stations) and at 24 Yordanska Street (Obolon district), small groups of residents from specific apartment buildings stepped onto pedestrian crossings following prolonged localized power outages caused by distribution line overloads. Although the actual duration of the localized fault on Yordanska Street was approximately 15 hours (explicitly attested by building residents in public discussion feeds), and the local Obolon community channel (@obolonlife) openly urged neighbors not to block traffic while thanking Patrol Police officers for calm de-escalation, NSDC-sanctioned outlet Strana.ua (@stranaua) picked up the street footage within 4 minutes 41 seconds and compiled a consolidated media album (@stranaua/253840..253842) at 20:21:58 Kyiv time (18:21:58 UTC). Exactly 27 minutes 03 seconds later (20:49:01 Kyiv time / 18:49:01 UTC), the Russian military Z-channel @RVvoenkor/126470..126472 published a fabrication about an alleged *"five-day energy revolt in Kyiv"*, utilizing 100% identical binary Telegram media objects (doc_id=5429119394091411064 and doc_id=5429119394091411065) cloned directly from Strana.ua's album without re-encoding. Two hours later (22:49:01 Kyiv time / 20:49:01 UTC), Russia's state news agency TASS (@tass_agency/404001) issued a federal wire dispatch explicitly citing sanctioned Strana.ua (*"reported by the Ukrainian publication Strana"*).
• Injection of Provocateurs into Kyiv Discussion Feeds: While the overwhelming majority of authentic Kyiv residents condemned road blockades during martial law, external provocateurs were injected under @truexakyiv/96829: account @Denov1977b (uid=5225374042), which attempted to splice the localized power fault onto the failed November 2 Borshchahivka provocation by spreading a fabricated legend that detained provocateur Valentyna Moloda was a *"combat field surgeon since 2022"* paired with the classic 2014 Russian propaganda slur *"jumped on Maidan"*, and a freshly registered nameless account uid=8895205236, which injected a direct extremist call to murder Ukrainian police officers and burn police vehicles.
• The 'Video Refrigerator' of the 85th Main Special Service Center of the GRU (@rezident_ua / @spletnicca) and the Anti-AWOL Return PSYOP: On the morning of November 4, 2026, after the informational wave around the Petropavlivska Borshchahivka incident (02.11.2026) collapsed following the detention of Valentyna Moloda and SBU identification of ~100 riot participants, operators of the 85th Main Special Service Center of the GRU of the General Staff of the Russian Armed Forces (Military Unit 26165, cartel @rezident_ua / @legitimniy / @spletnicca) deployed conserved archival footage. They retrieved a local clip from Kryvyi Rih (@hyevuy_k_r/29522 from 02.11.2026, 15:11:34 UTC, size 73.21 MB) that had sat untouched for 41 hours 30 minutes, re-encoded it at 2026-11-04T08:41:33Z (compressing it to 39.77 MB, new doc_id=5429401745241450945), and inserted it at 08:41:51 UTC (@rezident_ua/30983) as a 'sandwich' between Borshchahivka posts and a synchronized PSYOP campaign (@rezident_ua/30982, 30987, @spletnicca/24722, 24723) designed to intimidate AWOL (SZCh) servicemen against returning to their units.

SECTION 1. BINARY PROOF OF THE 'STRANA.UA -> RUSSIAN Z-CHANNELS -> TASS' TRANSIT DURING LOCALIZED POWER OUTAGES IN KYIV (04.11.2026)

1.1. Verified Ground Reality on Akademika Palladina Ave. and 24 Yordanska St. vs. the '5-Day Riot' Myth

On the evening of November 4, 2026, at two locations in Kyiv — Akademika Palladina Avenue (between Zhytomyrska and Akademmistechko metro stations) and 24 Yordanska Street (Obolon district) — small groups of residents from specific buildings stepped onto pedestrian crosswalks due to prolonged localized power outages following distribution grid overloads.

Primary-source verification refutes Russian state propaganda claims of a "five-day blackout" and "mass anti-government riots":

• Technical Cause of the Localized Faults (Official DTEK Kyiv Grids Statement): As explained in official DTEK statements (@kievreal1/140376 at 19:26:01 Kyiv / 17:26:01 UTC and the follow-up release at 22:09:10 Kyiv / 20:09:10 UTC across @k_dvizh/83965, @truexakyiv/96838, @kievreal1/140387, @obolonlife/61020), following Russian strikes on power generation and substations, specific buildings along Akademika Palladina Avenue and Yordanska Street experienced localized phase and substation equipment faults triggered by surge overloads when power was restored, while neighboring buildings on adjacent lines remained energized.
• Direct Testimony of a Yordanska Street Resident Confirming a 15-Hour Outage: In the discussion feed under @truexakyiv/96835 at 22:53:50 Kyiv time (20:53:50 UTC, record id=4068907), a resident of Yordanska Street (PeerUser(user_id=6447724046), display name Evgeniy Onegin) directly refuted the viral claim of "5 days without electricity":

> *"I am from Yordanska. The power was out for 15 hours, certainly not 5 days. This is probably a PSYOP"*.

• Position of the Local Obolon Community (@obolonlife/61008..61012): The neighborhood channel "Zhyttia OBOLON Kyiv" (@obolonlife, channel_id=1446965421), which served as the primary source for the footage from 24 Yordanska Street at 19:52:02 Kyiv time (17:52:02 UTC), explicitly called on residents not to block roadways (*"blocking roads WILL NOT SPEED UP power restoration"*) and commended Obolon Patrol Police officers for their calm, professional communication on site.

1.2. Minute-by-Minute MTProto Timeline and Cryptographic document.id Match Between Strana.ua and @RVvoenkor

Within Telegram's MTProto architecture, every uploaded video file receives a unique 64-bit document.id (doc_id) and an immutable server-side creation timestamp doc_date. If another channel uploads its own file or re-saves a video, Telegram assigns a new doc_id. An exact doc_id match across separate channels constitutes mathematical proof that the downstream channel directly cloned the internal Telegram media object from the upstream donor post.

The forensic conclusion is unambiguous: the editors of the Russian military propaganda outlet @RVvoenkor had no independent sources in Kyiv. They relied on NSDC-sanctioned @stranaua as their primary aggregator and verification bridge: both video files in @RVvoenkor/126470..126471 (doc_id=5429119394091411064, 664,658 bytes and doc_id=5429119394091411065, 4,854,348 bytes) are bit-for-bit identical to the Telegram server objects generated for @stranaua/253840..253841 at 18:19:06–18:19:07 UTC.

1.3. Anatomy of Provocateurs Injected Under @truexakyiv/96829

While authentic Kyiv residents overwhelmingly criticized road blockades in local discussion feeds, external operators attempted to artificially link the localized power outage to the failed November 2 provocation in Petropavlivska Borshchahivka and incite violent attacks on National Police officers under @truexakyiv/96829:

• Account @Denov1977b (PeerUser(user_id=5225374042), display name D. Zh. O.):
• At 20:26:19 Kyiv time (18:26:19 UTC, message id=4067762), injected a completely fabricated biography defending detained Borshchahivka provocateur Valentyna Moloda (/en/dossier/moloda-valentyna):

> *"Did you know that the medic who was locked up was a combat field surgeon since 2022... created a private ambulance service..."*

*(Note: as officially verified by MOH EMS Center Director V. Kryliuk and the Kyiv Regional EMS Center, Valentyna Moloda never worked in state emergency medicine and purchased the medical uniform and decommissioned ambulance herself prior to conducting 3 days of reconnaissance at the military staging facility).*

• Just 3 minutes 28 seconds later, at 20:29:47 Kyiv time (18:29:47 UTC, message id=4067783), the same account @Denov1977b output a classic Russian propaganda slur against the Revolution of Dignity:

> *"Hell of a way they jumped on Maidan [naskakali na moydane]"*.

• Freshly Registered Account PeerUser(user_id=8895205236) (no username, Telegram 889... registration batch):
• At 21:06:07 Kyiv time (19:06:07 UTC, message id=4068086), injected a direct extremist call to murder Ukrainian law enforcement officers and burn police cars:

> *"Kill the cops and burn their cars, a cop is an enemy of Ukraine"*.

SECTION 2. THE 'VIDEO REFRIGERATOR' OF THE 85TH MAIN SPECIAL SERVICE CENTER OF THE GRU (@REZIDENT_UA / @SPLETNICCA): FFPROBE CREATION_TIME AND MTPROTO DOC_ID RECONSTRUCTION

2.1. Collapse of the Borshchahivka Operation and Retrieval of a 41.5-Hour-Old Kryvyi Rih Video

The second forensic episode exposes the operational workflow of the 85th Main Special Service Center of the GRU of the General Staff of the Russian Armed Forces (Military Unit 26165), which operates the pseudo-Ukrainian Telegram cartel @rezident_ua ("Rezident"), @legitimniy ("Legitimniy"), and @spletnicca ("Spletnitsa").

After the SBU, National Police, and National Guard command on November 3, 2026 documented the ground reality at the temporary staging point of Military Unit 3121 in Petropavlivska Borshchahivka, detained lead provocateur Valentyna Moloda, and identified ~100 rioters, the GRU's informational wave rapidly stalled.

To manufacture the illusion of an ongoing "nationwide uprising against TCC and security forces" on the morning of November 4, 2026, @rezident_ua operators pulled a 3:10 street video with a red car from Kryvyi Rih out of their archival "refrigerator" and presented it as a breaking event of November 4.

Frame-by-frame inspection via ffmpeg / ffprobe and MTProto tracing established the exact manipulation chain down to the second:

• Primary Source of the Video (02.11.2026, 15:11:34 UTC / 17:11:34 Kyiv):
• At the 0:02 mark of the video in @rezident_ua/30983, an embedded watermark is visible at the bottom of the frame: **KHU*VYI KR [KR] TELEGRAM CHANNEL HKR**.
• Direct MTProto scanning of the Kryvyi Rih channel HKR (@hyevuy_k_r, channel_id=1327396140, inbox bot @hkr_chat_bot) located the original post https://t.me/hyevuy_k_r/29522, published on 2026-11-02T15:11:34+00:00 (62,245 views, 673 forwards).
• Binary parameters of the original file in @hyevuy_k_r/29522: doc_id=5424673918256460497, doc_date=2026-11-02T15:11:15+00:00, file size 73,211,137 bytes (73.21 MB), duration 191.067 s (3:11).
• Re-encoding Timestamp on the GRU Operator's Workstation (04.11.2026, 08:41:33 UTC):
• The local clip sat untouched by Russian federal channels for 41 hours 30 minutes.
• According to the MP4 container metadata (ffprobe format.tags.creation_time), the video file for @rezident_ua was re-encoded on the operator's workstation at 2026-11-04T08:41:33.000000Z, compressing the file from 73.21 MB to 39,767,082 bytes (39.77 MB) at 848x368 resolution (190.766667 s).
• Exactly 14 seconds after rendering completed (08:41:47 UTC), the file was uploaded to Telegram's servers with the new identifier doc_id=5429401745241450945, and 4 seconds later (08:41:51 UTC) published in @rezident_ua/30983.
• 100% Binary Clone in the Russian Z-Grid (@pridnestrovec/99065):
• At 2026-11-04T13:05:22+00:00 (4 hours 23 minutes after @rezident_ua/30983), Russian Z-channel @pridnestrovec (https://t.me/pridnestrovec/99065) copied the caption verbatim and attached the 100% identical Telegram media object doc_id=5429401745241450945 (39,767,082 bytes, doc_date=2026-11-04T08:41:47+00:00) without re-uploading.

2.2. The 'Sandwich' Technique and Synchronized PSYOP Against AWOL (SZCh) Return to Service

Analyzing the publication sequence across @rezident_ua and @spletnicca on November 4, 2026 reveals why GRU operators urgently re-encoded the 41.5-hour-old Kryvyi Rih clip at 08:41:33 UTC. The video served as an emotional primer ("sandwich") immediately preceding the cartel's primary operational payload of the day — sabotaging Ukraine's official procedure for returning AWOL (SZCh) servicemen to active duty:

• 07:04:01 UTC (@rezident_ua/30980) and 08:01:42 UTC (@rezident_ua/30982): morning attempt to salvage the failed Borshchahivka provocation and preview narratives about alleged *"private TCC prisons and holding pens for AWOL soldiers where people are broken and sent into assault brigades"*.
• 08:41:51 UTC (@rezident_ua/30983): insertion of the re-encoded November 2 Kryvyi Rih clip (doc_id=5429401745241450945) as visual reinforcement.
• 10:58:18 UTC (@rezident_ua/30987, #rezident_assessment): targeted psychological strike aimed at Ukrainian servicemen in AWOL status considering lawful return to their units:

> *"Borshchahivka raises a question that goes far beyond mobilization. What awaits a serviceman if he decides to return after AWOL [SZCh]? ... If a person is convinced that after returning he will be sent into an assault as expendable material, going AWOL becomes in his eyes the only way to survive"*.

• 15:26:01 UTC (@spletnicca/24722) and 16:44:06 UTC (@spletnicca/24723): synchronized amplification via the GRU satellite channel "Spletnitsa" alleging *"hundreds of secret prisons scattered across Ukraine"*.

SECTION 3. THE RUSSIAN ENERGY STRIKE BATTLE DAMAGE ASSESSMENT (BDA) FEEDBACK LOOP

Cross-referencing Russian strikes on Ukraine's power grid with the minute-by-minute telemetry of the 'Strana.ua -> Z-channels -> TASS' conveyor highlights a critical national security vulnerability created when localized utility faults are escalated into highway blockades:

• 58-Minute Battle Damage Assessment (BDA) for the Russian General Staff:
• The strategic objective of Russian combined missile and UAV strikes against Ukrainian thermal power plants and substations is not merely hardware damage, but triggering a secondary cascade: transport paralysis, diversion of National Police forces, and rear destabilization.
• When a localized 15-hour fault on a neighborhood feeder line in Kyiv results in blocking strategic transport choke points — specifically the western M-06 / M-07 highway approach along Akademika Palladina Avenue (between Zhytomyrska and Akademmistechko metro stations) and Obolon arteries — and appears on @stranaua within 4 minutes 41 seconds, is cloned by @RVvoenkor/126470 within 57 minutes 58 seconds of the first local post, and reaches the federal wire of TASS (@tass_agency/404001), the Main Operations Directorate of the Russian General Staff receives an immediate, free Battle Damage Assessment (BDA) report confirming socio-political impact.
• Within Russian target-planning cycles, such dispatches citing Ukrainian media bridges validate the effectiveness of energy terror against Kyiv and directly incentivize follow-up strikes against the same grid nodes.
• Physical Obstruction of Emergency Repair Crews and Defense Logistics:
• Blocking lanes on Akademika Palladina Avenue or Yordanska Street cannot physically accelerate the replacement of burned cable couplings or transformer relays. Instead, the resulting traffic jam directly delays DTEK emergency repair vehicles, ambulances, State Emergency Service (DSNS) units, and Defense Forces logistics.
• Counterintelligence Conclusions:
• The documented 100% match of binary MTProto document.id values (5429119394091411064 and 5429119394091411065) between the media album of NSDC-sanctioned Strana.ua (@stranaua/253840..253841) and the Russian military propaganda channel @RVvoenkor/126470..126471, followed by explicit citation on the federal wire of TASS (@tass_agency/404001), provides hard cryptographic proof of how @stranaua functions as an operational media bridge for Russian information warfare during martial law.